Read the docs
TI-2024-03965 Aliases CVE-2024-4260GHSA-5pqp-q4fm-4p4h

CoBlocks < 3.1.12 - Contributor+ SSRF

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00541 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Page Builder Gutenberg Blocks (Unknown): 3.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownPage Builder Gutenberg Blocks before 3.1.123.1.12Patch availableCNA
  • Page Builder Gutenberg Blocks VendorUnknown Affected before 3.1.12 Fixed in 3.1.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:godaddy:coblocks:*:*:*:*:*:wordpress:*:*before 3.1.12VulnerableGoDaddy
  • cpe:2.3:a:godaddy:coblocks:*:*:*:*:*:wordpress:*:* Versions before 3.1.12 Vulnerable ·GoDaddy

Remediation

  • Fix · CNA Page Builder Gutenberg Blocks (Unknown) Fixed in 3.1.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-4260
  2. 2026-10-03 Alias added: GHSA-5pqp-q4fm-4p4h

References

Exploit 1

  • TI-2024-06601 CoBlocks < 3.1.13 - Editor+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2024-00970 Page Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
  • TI-2024-02203 Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences